[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Codes for Identification of Federal and Federally-Assisted Organizations:

|   0902 | Botanic Garden                                                     |
|--------|--------------------------------------------------------------------|
|   0901 | Commission on Security and Cooperation in Europe                   |
|   0914 | John C. Stennis Center for Public Service Training and Development |
|   0904 | Office of Compliance                                               |
|   0962 | Permanent Committee for the Oliver Wendell Holmes Devise           |
|   0929 | U.S.

Codes for Identification of Federal and Federally-Assisted Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST Cloud Computing Forensic Reference Architecture provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-201

## NIST Cloud Computing Forensic Reference Architecture

Martin Herman Michaela Iorga Ahsen Michael Salim Robert H. Jackson Mark R. Hurst Ross A. Leo Anand Kumar Mishra Nancy M. Landreville

Yien Wang

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-201

<!-- image -->

## NIST Special Publication 800 NIST SP 800-201

## NIST Cloud Computing Forensic Reference Architecture

Martin Herman* Information Access Division Information Technology Laboratory

Michaela Iorga Computer Security Division Information Technology Laboratory

Ahsen Michael Salim American Data Technology, Inc. Robert H. Jackson Mark R. Hurst SphereCom Enterprises, Inc. Ross A. Leo University of Houston-Clear Lake The CyberSecurity Institute

Anand Kumar Mishra National Institute of Technology Sikkim India

Nancy M. Landreville Graduate School of Cybersecurity and Information Technology University of Maryland (GC)

Yien Wang Auburn University

*Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-201

July 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities.

NIST Cloud Computing Forensic Reference Architecture

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.8 (NIST 3.3.8)?

[Assistant]
According to Guide to Operational Technology (OT) Security:

3.3.8. 3.3.8.

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms:

roots of trust in server platforms. The integrity and location data of each host are leveraged in the orchestration and protection of workloads, as well as providing workloads access to specific data.
Workload orchestration can ensure that containers are instantiated only on server platforms that meet trustworthiness requirements and are in acceptable locations. Orchestration can also involve initial encryption of container images and releasing the decryption keys only to trusted servers. Additionally, the workloads themselves can be assigned identities based on these trusted attributes of the physical servers they reside on and be granted access to sensitive information based on their identities.

Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

De-Identifcation . . . . . | 18  |
| 3.2. | Evaluating the Risks and Benefts That Arise from De-Identifed Data Re- leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
| Evaluating the Risks and Benefts That Arise from De-Identifed Data Re- leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19  |
|                                                                            | 3.2.1. | Probability of Re-Identifcation . . . . | 21  |
|                                                                            |                                                                                | 3.2.2. Adverse Impacts of Re-Identifcation . | 24  |
|                                                                            |                                                                                | 3.2.3. Impacts Other Than Re-Identifcation                                                                                | 26  |
|                                                                            |                                                                                | 3.2.4. Remediation . . . . . . . . . . . . . . . | 27  |
|                                                                            |                                                                                | Data Life Cycle                                                                                |     |
| 3.3. . . | 3.3. . . | . . . . . . . . . . . . . . . . | 27  |
| 3.4. Data-Sharing Models . | 3.4.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Understanding Stablecoin Technology and Related Security Considerations:

iquidation. This is very similar to the maintenance of margin loans in the stock market. Margin investors in the stock market may be required to post additional collateral to cover stock market loses.
For stablecoin systems that utilize data oracles to maintain a parity with their chosen assets, finding the optimal method and frequency for updating the price is critical. If the stablecoin falls out of sync for too long of a period, the system may - in its attempt to correct - overcompensate and cause large price swings. For example, the failure of the IRON stablecoin and its associated $2.2 billion investor loss was that the oracle only updated every 10 minutes, which was insufficient during a period of rapid volatility [36]. Additionally, users may profit by leveraging the latency in the system and knowing how the stablecoin system will react to price updates.

Understanding Stablecoin Technology and Related Security Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

- [RFC 4492] Elliptic  Curve  Cryptography  (ECC)  Cipher  Suites  for  Transport  Layer Security (TLS), May 2006, see https://tools.ietf.org/html/rfc4492. - [RFC 5903] Elliptic Curve Groups Modulo a Prime (ECP Groups) for IKE and IKEv2, June 2010, see https://tools.ietf.org/html/rfc5903. - [RFC 7919] Negotiated Finite Field Diffie-Hellman Ephemeral Parameters, August 2016, see https://tools.ietf.org/html/rfc7919. - [SECG] Standards for Efficient Cryptography Group, see http://www.secg.org/. - [SEC2] Standards for Efficient Cryptography, SEC 2: Recommended Elliptic Curve Domain Parameters, September 2000, see http://www.secg.org/SEC2-Ver1.0.pdf. - [SP 800-38B]  Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication ,  May  2005,  with  updates dated October 2016. https://doi.org/10.6028/NIST.SP.800-38B
- [SP 800-38C]  Special Publication 800-38C, Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality , May 2004, with updates dated July 2007. https://doi.org/10.6028/NIST.SP.800-38C
- [SP 800-38F]  Special Publication 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping , December 2012. https://doi.org/10.6028/NIST.SP.800-38F
- [SP 800-52] Special Publication 800-52 Revision 2 (DRAFT), Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations , November 15, 2017. https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/draft
- [SP 800-56B]  Special  Publication  800-56B  Revision  1, Recommendation  for  Pair-Wise Key-Establishment  Schemes  Using  Integer  Factorization  Cryptography , September 2014. https://doi.org/10.6028/NIST.SP.800-56Br1
- [SP 800-56C]  Special Publication 800-56C Revision 1, Recommendation for Key Derivation Methods in Key Establishment Schemes , April 2018.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

nt of the monitoring strategy is covered in detail in Section 3.6. - Reporting requirements . Reporting requirements do not drive the  ISCM strategy but may play a role in the frequency of monitoring.
For instance, if OMB policy requires quarterly reports on the number of unauthorized components detected and corrective actions taken, the organization would monitor the system for unauthorized components at least quarterly.

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program:

- SP 800-137A, Assessing Information Security Continuous Monitoring Programs [1]
- The NIST Cybersecurity Framework (CSF) 2.0 [2]
- SP 800-30r1 (Revision 1), Guide for Conducting Risk Assessments [3]
- SP 800-37r2, Risk Management Framework for Information Security Systems and Organizations: A System Life Cycle Approach for Security and Privacy [4]
- SP 800-161r1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [5]
- Internal Report (IR) 8286, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management (ERM) [6]

Data from various sources (e.g., vulnerability scans, incident logs, and compliance assessments) can be aggregated to help executives understand information security. Summarizing measurement findings and metrics into concise reports facilitates efficient communication. Regularly reporting on measurement and assessment results fosters transparency, promotes accountability for meeting performance targets, and encourages continuous improvements. Sharing findings with executives demonstrates the organization's commitment to its information security posture.

Stakeholder interests may be determined through multiple venues, such as interviews, brainstorming sessions, mission statement reviews, in-house knowledge, and existing findings from risk assessments. There may also be laws and regulations that the organization may need to consider. Input from those who interact with individual systems and existing system-level data will provide targeted insight into the measurement needs of an organization. Ideally, stakeholder interests will be reviewed periodically during the ongoing work of the information security measurement program.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Division 2003 Annual Report:

| Welcome Letter | 2 | |-----------------------------------------------------|-----| | The Computer Security Division Responds to the | | | Federal Information Security Management Act of 2002 | 3 | | Outreach, Awareness and Education | 4 | | Security Management and Guidance | 8 | | Security Testing and Metrics | 14 | | Security Research and Emerging Technologies | 16 | | Cryptographic Standards and Applications | 26 | | Honors and Awards | 32 | | Computer Security Division Publications - 2003 | 34 | | Ways to Engage Our Division & NIST | 36 | - ◆ Standards to be used by Federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels - SP 800-37 Guidelines for the Security Certification and Accreditation of Federal Information Technology Systems, second public draft issued June 2003 - ◆ Guidelines recommending the types of information and information systems to be included in each category - FIPS 199 Standards for Security Categorization of Federal Information and Information Systems, public draft issued May 2003 - ◆ Minimum information security requirements (management, operational, and technical security controls) for information

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guide to LTE Security:

The mobile device hardware, mobile operating system (e.g., Android, Blackberry, iOS, Windows Phone), and 3rd party mobile applications are generally out of the scope of this document unless otherwise noted. This document does not analyze non 3rd Generation Partnership Project (3GPP) networks (e.g., WiFi, WiMAX, 3GPP2), forthcoming 3GPP features such as device to device cellular communications and cellular internet of things (IoT),  and the over-the-air (OTA) management updates to cellular platforms, and the networks supporting services (e.g Domain Name Services (DNS), Network Time Protocol (NTP)). Supply chain issues relating to cellular networks are also not described. Finally, the IP Multimedia Subsystem (IMS), a modern platform for delivering services such as Voice over LTE (VoLTE), is not included within this document.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Security-Focused Configuration Management of Information Systems provide? (Part 2)

[Assistant]
Circular. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-128 Natl. Inst. Stand. Technol. Spec. Publ. 800-128, 99 pages (August 2011) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-128

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Foundational Cybersecurity Activities for IoT Device Manufacturers provide? (Part 5)

[Assistant]
The IoT devices in scope for this publication can function on their own, although they may be dependent on specific other devices (e.g., an IoT hub) or systems (e.g., a cloud) for some functionality.
Many IoT devices have computing functionality, data storage, and network connectivity along with functionality associated with equipment that previously lacked these computing functions (e.g., smart appliances). In turn, these functions enable new efficiencies and technological capabilities for the equipment, such as remote access for monitoring, configuration, and troubleshooting. IoT can also enable the collection and analysis of data about the physical world and use the results to better inform decision making, alter the physical environment, and anticipate future events [1]. IoT devices are acquired and used by many customers: individuals, companies, government agencies, educational institutions, and other organizations. Unfortunately, IoT devices often lack device capabilities that customers can use to help mitigate their cybersecurity risks, such as the functionality customers routinely expect their desktop and laptop computers, smartphones, tablets, and other IT devices to have. Consequently, IoT device customers may have to select, implement, and manage additional or new cybersecurity controls or alter the controls they already have. Compounding this task, customers may not know they need to alter their existing processes to accommodate the unique characteristics of IoT. The result is many IoT devices are not secured in the face of evolving threats; therefore, attackers can more easily compromise IoT devices and use them to harm device customers and conduct additional nefarious acts (e.g., distributed denial of service [DDoS] attacks) against other organizations. 1

The purpose of this publication is to give manufacturers recommendations for improving how securable the IoT devices they make are.

Foundational Cybersecurity Activities for IoT Device Manufacturers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Trustworthy Email:

| CM-9 | CONFIGURATION MANAGEMENT PLAN | - | CM-9 | CM-9 | |----------------------------------------|--------------------------------------------|----------------------------------------|----------------------------------------|----------------------------------------| | CM-10 | SOFTWARE USAGE RESTRICTIONS | CM-10 | CM-10 | CM-10 | | CM-11 | USER-INSTALLED SOFTWARE | CM-11 | CM-11 | CM-11 | | CONTINGENCY PLANNING | CONTINGENCY PLANNING | CONTINGENCY PLANNING | CONTINGENCY PLANNING | CONTINGENCY PLANNING | | CP-1 | CONTINGENCY PLANNING POLICY AND PROCEDURES | CP-1 | CP-1 | CP-1 | | CP-2 | CONTINGENCY PLAN | CP-2 | CP-2 (1,3,8) | CP-2 (1,2,3,4,5,8) | | CP-3 | CONTINGENCY TRAINING | CP-3 | CP-3 | CP-3 (1) | | CP-4 | CONTIGENCY PLAN TESTING | CP-4 | CP-4(1) | CP-4 (1,2) | | CP-6 | ALTERNATE STORAGE SITE | - | CP-6 (1,3) | CP-6 (1,2,3) | | CP-7 | ALTERNATE PROCESSING SITE | - | CP-7 (1,2,3) | CP-7 (1,2,3,4) | | CP-8 | TELECOMMUNICATION SERVICES | - | CP-8 (1,2) | CP-8 (1,2,3,4) | | CP-9 | SYSTEM BACKUP | CP-9 | CP-9 (1) | CP-9 (1,2,3,5) | | CP-10 | SYSTEM RECOVERY AND RECONSTITUION | CP-10 | CP-10 (2) | CP-10 (2,4) | | CP-11 | ALTERNATE COMMUNICATION PROTOCOLS | - | - | - | | CP-12


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

3.1.4  Cryptographic Vulnerability (CWE-310)

Description

Cryptography is the use of mathematical principles and their implementations to ensure that
information is hidden from unauthorized parties, the information is unchanged, and the intended
party can verify the sender.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.    ITL  develops  tests, test  methods,  reference  data,  proof  of  concept  implementations,  and  technical  analysis  to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified  information  in  Federal  computer  systems.    This  Special  Publication  discusses ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative activities with industry, government, and academic organizations.

Maintaining  physical  and  logical  security  over  clients  can  be  troublesome,  especially  with embedded mobile devices such as smart phones.  Their size and portability can result in the loss of  physical  control.    Built-in  security  mechanisms  often  go  unused  or  can  be  overcome  or circumvented  without  difficulty  by  a  knowledgeable  party  to  gain  control  over  the  device. Moreover, cloud applications are often delivered to them through custom-built native applications (i.e., apps) rather than a Web browser.

The two lowest layers shown denote the physical elements of a cloud environment, which are under  the  full  control  of  the  cloud  provider,  regardless  of  the  service  model.    Heating, ventilation, air conditioning (HVAC), power, communications, and other aspects of the physical plant form  the bottom  layer, the facility layer , while computers, network  and  storage components,  and  other  physical  computing  infrastructure  elements  form  the hardware  layer immediately above it.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Profile for Liquefied Natural Gas:

| Priority Cybersecurity Framework Subcategories by Mission Objective ................... | Priority Cybersecurity Framework Subcategories by Mission Objective ................... | 23                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| References...................................................................................................................................47                                                                                | References...................................................................................................................................47                                                                                | References...................................................................................................................................47                                                                                |
| Appendix A.

Cybersecurity Framework Profile for Liquefied Natural Gas


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Representation of PIV Chain-of-Trust for Import and Export:

may be maintained in a chain-of-trust record. As per FIPS 201-2, 'a card issuer may optionally maintain, for each PIV Card issued, a documentary chain-of-trust for the identification data it collects.
The chain-of-trust is a sequence of related enrollment data records that are created and maintained through the methods of contemporaneous acquisition of data within each enrollment data record, and biometric matching of samples between enrollment data records.'

Representation of PIV Chain-of-Trust for Import and Export


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992 provide? (Part 4)

[Assistant] y^:-0fm- X;d' - Sx.p<sttt^p: - , 7 .•-.: :i^mm'm$< O^^Xd^-r X-;' ,-'^7:i ' ••' ' , ;, ' '' 1 ; ## Contents | 1 Executive Summary | 1 Executive Summary | 1 Executive Summary | 1 | |----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|-------| | | | | 1 | | 1.1 Purpose of the Workshop | 1.1 Purpose of the Workshop | 1.1 Purpose of the Workshop | | | 1.2 Structure of the Workshop 1.3 Workshop Recommendations | 1.2 Structure of the Workshop 1.3 Workshop Recommendations | 1.2 Structure of the Workshop 1.3 Workshop Recommendations | 1 | | 2 Workshop Participants | 2 Workshop Participants | 2 Workshop Participants | 4 | | 3 Introductory Session | 3 Introductory Session | 3 Introductory Session | 5 | | 4 | Session on Authentication in Distributed Networks | Session on Authentication in Distributed Networks | 7 | | | | Standards and Technology | 7 | | 4.2 General Discussion on Authentication 5 Session on Access Control in Distributed Networks | 4.2 General Discussion on Authentication 5 Session on Access Control in Distributed Networks | 4.2 General Discussion on Authentication 5 Session on Access Control in Distributed Networks | | | | |

Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to CMVP Approved Non-Invasive Attack Mitigation Test Metrics_ CMVP Validation Authority Updates to ISO_IEC 24759:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

CMVP Approved Non-Invasive Attack Mitigation Test Metrics_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to ISCMA_ An Information Security Continuous Monitoring Program Assessment:

The Restart Assessment action allows modification of the three assessment parameters-risk management level, depth, and breadth-that are described in Section 3.5.

ISCMA_ An Information Security Continuous Monitoring Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leade rship for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. | 1. Introduction.....................................................................................................................................1                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Scope of Consumer-Grade Routers...................................................................................................5                                                                                |
| 3.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

3.1.4                                                                                | Matching... 3.1.4 Functionality

The primary function of a tag is to provide an identifier to a reader, but many types of tags support additional capabilities that are valuable for certain business processes. 3.1.4 Matching

In a matching application , two tagged items are matched with each other and a signal (e.

Guidelines for Securing Radio Frequency Identification (RFID) Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

3.4.3. 3.4.3. 3.4.3.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Small Business Information Security_ The Fundamentals:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be  used  by  Federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  Federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in Federal information systems.

The authors, Celia Paulsen and Patricia Toth wish to thank Richard Kissel and Dr. Hyunjeong Moon for their extensive contributions to this publication. Since 2002, NIST along with the Small Business Administration and the Federal Bureau of Investigation's InfraGard program, has conducted research and outreach to small businesses - much of this publication is thanks to their generous time and effort. The authors would like to thank their partners and the small businesses who contributed to this work. In addition, they would like to thank those colleagues and reviewers who contributed to the document's development.

Small Business Information Security_ The Fundamentals


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to NIST Cloud Computing Forensic Science Challenges:

Dynamic Host Configuration Protocol | FC ID | Short Title | Challenge | Description | Result of Overcoming Challenge | |---------|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | FC-15 | Malicious code may circumvent VMisolation methods | Malicious code may circumvent virtual machine isolation methods and interfere with the hypervisor or other guest virtual machines | Vulnerabilities in server virtualization allow an attacker to escape from a guest virtual machine to another guest or to the hypervisor itself.

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2005 Annual Report provide? (Part 5)

[Assistant]
ments  and results of security program assessments - SP 800-26 Revision 1, Guide for Information  Security  Program  Assessments  and System  Reporting  Form (first  public  draft issued August 2005).
- Bring  the  security  planning  process  up to  date  with  key  standards  and  guidelines  developed  by  NIST -  SP  800-18 Revision 1, Guide for Developing Security Plans  for  Federal  Information  Systems (first public draft issued August 2005). - Provide  assistance  to  Agencies  and private sector - Conduct ongoing, substantial  reimbursable  and  non-reimbursable assistance support, including many outreach efforts  such  as  the  Federal  Information Systems  Security  Educators'  Association (FISSEA), the  Federal  Computer  Security Program  Managers'  Forum  (FCSM  Forum), the Small Business Corner, and the Program Review  for  Information  Security  Management Assistance (PRISMA). - Evaluate security policies and technologies from the private sector and national  security  systems  for  potential Federal  agency  use -  Host  a  growing repository  of  Federal  agency  security  practices, public/private  security  practices, and security configuration checklists for IT products. In conjunction with the Government  of  Canada's  Communications Security Establishment, CSD leads the Cryptographic  Module  Validation  Program (CMVP). The  Common  Criteria  Evaluation and Validation  Scheme  (CCEVS)  and  CMVP facilitate  security  testing  of  IT  products usable by the Federal government. - Solicit recommendations of the Information Security and Privacy Advisory Board on draft standards and guidelines -  Solicit  recommendations  of the Board regularly at quarterly meetings. - Provide outreach, workshops, and briefings - Conduct ongoing awareness briefings and  outreach  to  our  customer  community and  beyond  to  ensure  comprehension  of guidance  and  awareness  of  planned  and future activities.

Computer Security Division 2005 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to PIV Data Model Test Guidelines:

| Precondition(s)    | 1. A valid PIV card is inserted into the contact reader. h card handle. on the PIV card. 2. A valid PC/SC connection exists between the test application and the contact reader. 3. The test application is currently connected to the card application which is accessible throug 4. A valid CCC is present   |
|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Test Scenario      | 1. Set cardHandle := <<valid card handle>>. .0)>>. 2. Set OID := <<CCC (2.16.840.1.101.3.7.1.219 3. Call pivGetData w/ • (IN) cardHandle • (IN) OID • (OUT) data 4. Read and parse the byte array in accordance with BER-TLV format. |
| Expected Result(s) | 1. The size of the byte array does not exceed 297 byte 2. All mandatory tags in CCC table are present. ble tags co s. nform with the vendor p 3. The values of the availa rovided data. |

| Purpose            | Confirms that the CHUID of the PIV card Application conforms to the PIV data model requirements as per Appendix Aof SP80073 . |
|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Reference(s)       | 1. SP80073 , AppendixA TE04.01.01.01 2. 3. TE04.03.01.01                                                                                |
| Precondition(s)    | 1. A valid PIV card is inserted 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Forensic Filtering of Cell Phone Protocols provide? (Part 3)

[Assistant]
plying a forensic filter to phone manager protocol exchanges with a device is proposed as a means to reduce risk. Keywords : Cell Phone, Computer Forensics, Protocol Filter

## Table of Contents

| 1.
| Introduction ..............................................................................................................1                                                                                | Introduction ..............................................................................................................1                                                                                |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------|
| 2.

Forensic Filtering of Cell Phone Protocols

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

assembly, testing, acceptance, maintenance, system and network administration, shipping and receiving, packaging and labeling, delivery, inventory management, finance, disposal, and waste management.
| Process                                                     | Risk Executive Function   | CIO     | SISO    | Contracting   | Legal   | Mission/Business Owner   |
|-------------------------------------------------------------|---------------------------|---------|---------|---------------|---------|--------------------------|
| Plan Procurement                                            | Oversee                   | Oversee | Oversee | Lead          | Approve | Lead                     |
| Define/Develop Requirements                                 | Oversee                   | Oversee | Oversee | Advise        | Advise  | Lead                     |
| Identify Potential Suppliers and/or Perform Market Analysis | Oversee                   | Oversee | Oversee | Advise        | Advise  | Lead                     |
| Complete Procurement                                        | Oversee                   | Oversee | Approve | Lead          | Approve | Lead                     |
| Operations and Maintenance                                  | Oversee                   | Oversee | Oversee | Advise        | Advise  | Lead                     |

Notional Supply Chain Risk Management Practices for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Supply Chain Risk Management?

[Assistant]
According to Fiscal Year 2022 Cybersecurity and Privacy Annual Report:

(EO)14028. This effort included cybersecurity supply chain risk management practices and guidelines for software developer verification, systems security engineering, and secure software development.
- Hardware security mechanisms and governance safeguards guidance was finalized to measure and attest to the integrity of the platform in an infrastructure-as-a-service (IaaS) cloud deployment model and other multi-tenant cloud environments. - The development of the Cybersecurity for IoT program has progressed through stakeholder engagement, guidance for consumers of IoT products and federal agencies, and practical guidance for securing industrial internet of things (IIoT) devices (e.g., distributed energy resources).

Fiscal Year 2022 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Automation Support for Control Assessments_ Project Update and Vision:

The first volume in the IR 8011 series ( Overview ) establishes the approach and organization of the methodology that is followed and adhered to by subsequent volumes. Both the Overview volume (8011v1 [2]) and the first capability-specific volume ( Hardware Asset Management [3]) were published in 2017. The second capability-specific volume ( Software Asset Management [4]) was released in 2018, and the third capability-specific volume ( Software Vulnerability Management [6]) was published in 2020. NIST updated SP 800-53 [7] in 2020 and SP 800-53A [9] in 2022.

Automation Support for Control Assessments_ Project Update and Vision


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

3.3.2. 3.3.2, Part 1 for a description of the Discovery Object's structure returned in the data field) or - BER-TLV of the 0x7F61 BIT Group Template (see Table 7 of SP 800-76)   |
|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SW1-SW2      | Status word                                                                                |

For all other PIV data objects (if present):

| Data Field   | BER-TLV with the tag '53' containing in the value field of the requested data object. 3.3.2, Part 1 |

For the 0x7F61 BIT Group template:

Table 9.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

| 1 | Introduction ............................................................................................................1 | Introduction ............................................................................................................1 | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 2 | Hardware Platform Security Overview .................................................................3 | Hardware Platform Security Overview .................................................................3 | | 3 | Platform Integrity Verification...............................................................................5 | Platform Integrity Verification...............................................................................5 | | | 3.1 Hardware Security Module (HSM) | ..................................................................

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems:

Note that this architecture could facilitate the development of applications that do not store user identity and session data. User permission may then be necessary for an application to access user profile and session data prior to executing a given transaction (e.g., opening a bank account).

Many  projects  are  currently  under  active  development,  characterizing  the  growing  interest  in blockchain-based identity management.

In addition to the scalability benefits, second layer protocols can help promote the development of interoperable, blockchain-agnostic systems. They do not function as standalone blockchains but rather  require  one  or  more  blockchains  to  operate,  allowing  for  the  integration  of  multiple blockchains  without  necessarily  involving  any  fundamental  change  to  their  codebase.  Finally, second layer protocols may have a different level of privacy than transactions in the underlying blockchain, though this has to be determined on a case-by-case basis.

A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.07.04.b: media with diagnostic and test programs are checked for malicious code before the media are used in the system.

[SELECT FROM: processes for approving, controlling, and monitoring maintenance tools; mechanisms for supporting or implementing the approval, control, or monitoring of maintenance tools; processes for preventing the unauthorized removal of information; processes for inspecting media for malicious code; mechanisms for supporting media sanitization or the destruction of equipment; mechanisms for supporting the verification of media sanitization; processes for inspecting maintenance tools; mechanisms for supporting or implementing the inspection of maintenance tools; mechanisms for supporting or implementing the inspection of media used for maintenance]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

| 17     |
| 05-20-2019 | Substantive | Deleted 'and devices' from PR.AC-1 Low security level and Added 'Establish and manage identification mechanisms and credentials for users and devices of the manufacturing system.' to the PR.AC-1 Moderate security level. | 22     |
| 05-20-2019 | Substantive | Changed 'Protect network integrity of the manufacturing system, incorporating network segregation where appropriate.' to 'Protect network integrity of the manufacturing system, incorporating network segmentation and segregation where appropriate.' in PR.AC-5 Low security level. | 24     |
| 05-20-2019 | Substantive | Moved 'Protect the manufacturing system against, or limit the effects of, denial of service attacks.' from the PR.DS-4 Low security level to the PR.DS-4 Moderate and High security levels. | 26     |
| 05-20-2019 | Substantive | Moved 'Heighten system monitoring activity whenever there is an indication of increased risk to manufacturing operations and assets.' from the PR.DS-5 Low security to the PR.DS-5 Moderate and High security levels. | 26     |
| 05-20-2019 | Substantive | Deleted 'Manufacturing systems are often connected to business systems or interconnected. Any single system can be an attack vector for all systems. It is therefore necessary to provide a uniform defense encompassing all baselines.' from PR.IP-8. | 31     |
| 05-20-2019 | Substantive | Changed 'Test response and recovery plans to determine the effectiveness of the plans, and the readiness to execute the plans.' to 'Review response and recovery plans to determine the effectiveness of the plans, and the readiness to execute the plans.' in PR.IP-10 Low security level. | 31     |
| 05-20-2019 | Substantive | Added 'Test response and recovery plans to determine the effectiveness of the plans, and the readiness to execute the plans.' to PR.IP-10 Moderate and High security level.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

| Using and Integrating Multiple IDPS Technologies......................................................8-1 | Using and Integrating Multiple IDPS Technologies......................................................8-1 | | | 8.1 | The Need for Multiple IDPS Technologies...............................................................8-1 | The Need for Multiple IDPS Technologies...............................................................8-1 | | | 8.2 | Integrating Different IDPS Technologies..................................................................8-2 | Integrating Different IDPS Technologies..................................................................8-2 | | | | 8.2.1 | Direct IDPS Integration.................................................................................8-2 | | | | 8.2.2 | Indirect IDPS Integration | ..............................................................................8-3 | | 8.3 | Other Technologies with IDPS Capabilities .............................................................8-4 | Other Technologies with IDPS Capabilities .............................................................8-4 | | | | 8.3.1 | Network Forensic Analysis Tool (NFAT) Software .......................................8-4 | | | | 8.3.2 | Anti-Malware Technologies ..........................................................................8-5 | | | | 8.3.3 | Firewalls and Routers...................................................................................8-6 | | | | 8.3.4 | Honeypots ....................................................................................................8-7 | | | 8.4 | Summary..................................................................................................................8-7 | Summary..................................................................................................................8-7 | | | 9.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Quick Start Guide for Populating Mobile Test Devices:

Computer Forensic Tool Testing; Digital Forensics; Federated Testing; Mobile Forensics

The intended audience ranges from law enforcement to forensic practitioners and examiners testing and utilizing digital forensic tools often used in incident response and criminal investigations.

This guide describes how to populate a mobile device as part of testing a mobile forensic tool.  It was built to be used with Federated Testing, but can also be used to populate a device for use with other test approaches.  The Federated Testing project 1 is an expansion of the Computer Forensics Tool Testing (CFTT) Program at NIST which provides digital forensics investigators and labs with test materials for forensic tool testing. The goal of Federated Testing is to help digital forensics investigators to test the tools that they use in their labs and to enable sharing of tool test results within the digital forensics community. The goals of this guide are twofold: 1) provide guidance for how to populate (place test data on) a moble device for use in forensic tool testing and 2) provide guidance to select data elements for inclusion that ensure effective testing.

Quick Start Guide for Populating Mobile Test Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

.................................................................. 1
1.1   PURPOSE AND APPLICABILITY ...................................................................................................
2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Guide to Computer Security Log Management:

3.3.1 Syslog Format... 3.3.1 describes the format of syslog messages, and Section 3. 3.3.1 Syslog Format

Syslog assigns a priority to each message based on the importance of the following two attributes:

- GLYPH<c=31,font=/APONEK+Webdings> Message type, known as a facility .

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Information Technology Security Services:

ecovering the encryption key when the key is unavailable. 11
-  Privilege/Authorization -certificates can be used to vouch for a user's identity and also specify privileges the user has been granted.
| Certificate Validation                              | Validity checking of certificates with the service provider that issued the certificate whenever the application requires authentication of those attempting access   |
|-----------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Certificate Issuance                                | Issuance of certificates to applicants if identity proofing has been successfully completed by the service provider, or provided by the organization                  |
| Supplemental PKI Services                           | PKI-related programming, systems integration, and telecommunications interface support                                                                                |
| Technology Updates                                  | Incorporation of new algorithms, formats, technologies, mechanisms, and media                                                                                |
| Ad Hoc Data Collection, Analysis, and Dissemination | Ad hoc data collection, analysis, and/or dissemination services related to PKI services                                                                               |
| Hardware Tokens                                     | Hardware tokens to generate key pairs and storage of the private key. |

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters:

3.2.1. 3.2.1), a Montgomery curve (Section 3. 3.2.1.

Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

|      |                                                                    |                                                                                | Page Number                                                                                |    |
|------|--------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|----|
|      | R4 . | Sample Impacts of Threats to and Vulnerabilities of Communications                                       | Sample Impacts of Threats to and Vulnerabilities of Communications                                       | 44 |
|      | R4.5a                                                              | Sample Impacts of Threats to and Vulnerabilities of Computer Hardware                                    | Sample Impacts of Threats to and Vulnerabilities of Computer Hardware                                    | 45 |
|      | R4.5b                                                              | Sample Impacts of Threats to and Vulnerabilities of Computer Software                                    | Sample Impacts of Threats to and Vulnerabilities of Computer Software                                    | 46 |
|      | R4 . | Sample Impacts of Threats to and Vulnerabilities of ADP System procedures, Administration and Management | Sample Impacts of Threats to and Vulnerabilities of ADP System procedures, Administration and Management | 47 |
|      | R4.7a                                                              | Environmental Threats: Data on U.S. Earthquake Activity                                                  | Environmental Threats: Data on U.S. Earthquake Activity                                                  | 48 |
|      | R4 .

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 3)

[Assistant]
ft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. ## Abstract

This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level-low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

ies that provide assurance of identity and are interoperable Government-wide and accepted across all Executive Branch agencies;

- a. Assign an impact level to all information and information systems.
Agencies must follow the processes outlined in FIPS 199, Standards for Security Categorization of Federal Information and Information Systems , to categorize all information and information systems according to the standard's three levels of impact (i.e . , low, moderate, and high). Agencies should generally consider categorizing sensitive, personally identifiable information (and information systems within which such information resides) as moderate or high impact. - b. Implement minimum security requirements and controls. For each of the impact levels identified above, agencies must implement the minimum security requirements and minimum (baseline) security controls set forth in FIPS 200 , Minimum Security Requirements for Federal Information and Information Systems, and NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems 25 , respectively. - c. Certify and accredit information systems. Agencies must certify and accredit (C&A) all information systems supporting the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. The specific procedures for conducting C&A are set out in NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems , 26 and include guidance for the continuous monitoring of certain security controls. Agencies' continuous monitoring should assess a subset of the management, operational, and technical controls used to safeguard such information ( e.g. , Privacy Impact Assessments).

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

The  security  objectives  of  an  organization  are  a  key  factor  for  decisions  about  outsourcing information technology services and, in particular, for decisions about transitioning organizational data, applications, and other resources to a public cloud computing environment. Organizations  should  take  a  risk-based  approach  in  analyzing  available  security  and  privacy options  and  deciding  about  placing  organizational  functions  into  a  cloud  environment. The information  technology  governance  practices  of  the  organizations  that  pertain  to  the  policies, procedures, and standards used for application development and service provisioning, as well as the design, implementation, testing, use, and monitoring of deployed or engaged services, should be extended to cloud computing environments.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Stateful Hash-Based Signature Schemes:

## Conformance Testing

Conformance testing for implementations of the functions that are specified in this publication will be conducted within the framework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic Module Validation Program (CMVP). The requirements that apply to these implementations are indicated by the word ' shall .' Some of these requirements may be out-of-scope for CAVP or CMVP validation testing and, thus, are the responsibility of entities using, implementing, installing, or configuring applications that incorporate this Recommendation.

Recommendation for Stateful Hash-Based Signature Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

Filtering inbound traffic is known as ingress filtering . Outgoing traffic can also be filtered, a process referred to as egress filtering . Here, organizations can implement restrictions on their internal traffic, such as blocking the use of external file transfer protocol (FTP) servers or preventing denial of service (DoS) attacks from being launched from within the organization against outside entities. Organizations should only permit outbound traffic that uses the source IP addresses in use by the organization-a process that helps block traffic with spoofed addresses from leaking onto other networks. Spoofed addresses can be caused by malicious events such as malware infections or compromised hosts being used to launch attacks, or by inadvertent misconfigurations. Application firewalls can enable the identification of unexpected sequences of commands, such as issuing the same command repeatedly or issuing a command that was not preceded by another command on which it is dependent. These suspicious commands often originate from buffer overflow attacks, DoS attacks, malware, and other forms of attack carried out within application protocols such as HTTP. Another common feature is input validation for individual commands, such as minimum and maximum lengths for arguments. For example, a username argument with a length of 1000 characters is suspicious-even more so if it contains binary data. Application firewalls are available for many common protocols including HTTP, database (such as SQL), email (SMTP, Post Office Protocol [POP], and Internet Message Access Protocol [IMAP]) 3 , voice over IP (VoIP), and Extensible Markup Language (XML).

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

## Guidelines for the Use of PIV Credentials in Facility Access

## Guidelines for the Use of PIV Credentials in Facility Access

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

The management of configurations has traditionally been viewed as an IT management best practice. 7 Using SecCM to gain greater control over and ensure the integrity of IT resources facilitates asset management, improves incident response, help desk, disaster recovery and problem solving, aids in software development and release management, enables greater automation of processes, and supports compliance with policies and preparation for audits.

- Ability to pull information from a variety of sources (different type of components, different operating systems, different platforms, etc.);
- Use of standardized specifications such as Extensible Markup Language (XML) and SCAP;
- Integration with other products such as help desk, inventory management, and incident response solutions;
- Vendor-provided support (patches, updated vulnerability signatures, etc.);
- Compliance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines and link vulnerabilities to NIST [SP 800-53] controls;
- Standardized reporting capability (e.g. SCAP, XML) including the ability to tailor output and drill down; and
- Data consolidation into Security Information and Event Management (SIEM) tools and dashboard products.

As changes are made to baseline configurations, the new baseline becomes the current version, and the previous baseline is no longer valid but is retained for historical purposes. If there are issues with a production release, retention of previous versions allows for a rollback or restoration to a previous secure and functional version of the baseline configuration. Additionally, archiving previous baseline configurations is useful for incident response and traceability support during formal audits. 23

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

reover, adversaries are using the supply chain as an attack vector and effective means of penetrating our systems, compromising the integrity of system elements, and gaining access to critical assets.
- To provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;
- To institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient, and cost-effective execution of the RMF;
- To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the RMF and implemented using established NIST risk management processes;
- To integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;
- To promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1 [SP 800-160 v1], with the relevant tasks in the RMF;
- To integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; and
- To allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

g/10.6028/NIST.SP.800-207A
- [7] OWASP (2023) OWASP Top 10 API Security Risks. Available at https://owasp.org/APISecurity/editions/2023/en/0x11-t10/
- [8] OWASP (2023) API2:2023 Broken Authentication.
Available at https://owasp.org/APISecurity/editions/2023/en/0xa2-broken-authentication/
- [9] Wikipedia (2025) Fatigue Attack. Available at https://en.wikipedia.org/wiki/Multi-factor\_authentication\_fatigue\_attack
- [10] Wikipedia (2024) Billion laughs attack. Available at https://en.wikipedia.org/wiki/Billion\_laughs\_attack
- [11] Wikipedia (2025) Zip bomb. Available at  https://en.wikipedia.org/wiki/Zip\_bomb
- [12] National Institute of Standards and Technology (2024) The NIST Cybersecurity Framework (CSF) 2.0. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29
- [13] Wikipedia (2025) Principle of least astonishment. Available at https://en.wikipedia.org/wiki/Principle\_of\_least\_astonishment
- [14] F# for fun and profit (2013) Designing with types: Making illegal types unrepresentable. Available at https://fsharpforfunandprofit.com/posts/designing-with-types-makingillegal-states-unrepresentable/

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks:

| Special Publication                             |

- [1] Newhouse W, Keith S, Scribner B, Witte G (2017) National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-181. https://doi.org/10.6028/NIST.SP.800-181
- [2] Simmon E (forthcoming) A Model for the Internet of Things (IoT). (National Institute of Standards and Technology, Gaithersburg, MD). - [3] Stouffer K, Pillitteri V, Lightman S, Abrams M, Hahn A (2015) Guide to Industrial Control Systems (ICS) Security. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-82, Rev. 2. https://doi.org/10.6028/NIST.SP.800-82r2
- [4] Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2
- [5] Brooks S, Garcia M, Lefkovitz N, Lightman S, Nadeau E (2017) An Introduction to Privacy Engineering and Risk Management in Federal Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8062. https://doi.org/10.6028/NIST.IR.8062
- [6] National Institute of Standards and Technology (2018) Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards and Technology, Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018
- [7] Joint Task Force (2017) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), Draft NIST Special Publication (SP) 800-53, Rev. 5. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft
- [8] Office of Management and Budget (2016) Managing Information as a Strategic Resource.

Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to IT Security for Industrial Control Systems:

A SCADA typically consists of a Central Monitoring System (CMS), contained within the plant and one or more Remote Stations. The CMS houses the Control Server and the communications routers via a peer-to-peer network. The CMS collects and logs information gathered by the remote stations and generates necessary actions for events detected. A remote station consists of either a Remote Terminal Unit (RTU) or a Programmable Logic Controller (PLC) which controls actuators and monitors sensors. Remote stations, typically, have the added capability to be interfaced by field operators via hand held devices to perform diagnostic and repair operations. The communications network is the medium for transporting information between remote stations and the CMS. This is performed using telephone line, cable, or radio frequency. If the remote site is too isolated to be reached directly via a direct radio signal, a radio repeater is used to link the site.

IT security [2] [3] has not been a significant issue within the process controls community. Systems were designed to meet performance, reliability, safety, and flexibility requirements and were typically physically isolated and based on proprietary hardware and communications. The introduction of Internet based information technology within the process controls industry has increased vulnerabilities to the industry's computer systems. Centralized operation and remote

Firewall - A device on a communications network that can be programmed to filter information based on the information content, source or destination.

IT Security for Industrial Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

Information Type......................53 | | | C.2.8.10 Entitlement Event Information Information Type..................................................54 | | | C.2.8.11 Representative Payee Information Information Type ............................................56 | | | C.2.8.12 General Information Information Type..................................................................57 | | | Rationale and Factors for Government Resource Management Information................58 | Rationale and Factors for Government Resource Management Information................58 | | C.3.1 Administrative Management............................................................................................58 | | | C.3.1.1 Facilities, Fleet, and Equipment Management Information Type.............................58 | | | C.3.1.2 Help Desk Services Information Type......................................................................60 | | | C.3.1.3 Security Management Information Type ..................................................................61 | | | C.3.1.4 Travel Information Type...........................................................................................63 | | | C.3.1.5 Workplace Policy Development and Management Information Type ( Intra- Agency Only ) ...........................................................................................................65 | | | C.3.2 Financial Management.....................................................................................................65 | | | C.3.2.1 Assets and Liability Management Information Type................................................66 | | | C.3.2.2 Reporting and Information Information Type...........................................................67 | | | C.3.2.3 Funds Control Information Type...............................................................................68 | | | C.3.2.4 Accounting Information Type...................................................................................69 | | | C.3.2.5 Payments Information Type......................................................................................70 | | | C.3.2.6 Collections and Receivables Information Type ........................................................72 | | | C.3.2.7 Cost Accounting/ Performance Measurement Information Type .............................73 | |

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices